ansible-role-conductor-workflows-user-management/templates/group_created.json.j2

{
	"ownerApp" : "Orchestrator",
	"name" : "group_created",
	"createBy" : "Marco Lettere",
	"description": "Handle workflow related to Portal event group_created",
	"version" : 1,
	"ownerEmail" : "marco.lettere@nubisware.com",
	"inputParameters" : ["user", "group"],
	"tasks" : [
		{
		  "name": "INLINE_TASK",
		  "taskReferenceName": "init",
		  "type": "INLINE",
		  "inputParameters": {
			  "root_vo": "{{ root_vo }}",
			  "keycloak": "{{ keycloak }}/{{ keycloak_realm }}",
			  "keycloak_admin" : "{{ keycloak_admin }}/{{ keycloak_realm }}",
			  "group" : "${workflow.input.group}",
			  "evaluatorType" : "javascript",
			  "expression": "function e(v){ return (v == null || (v.trim && v.trim() === ''))}; function f(){if(e($.group)) throw('Group must not be empty'); var tree = $.group.startsWith('%2F') ? $.group.split('%2F') : [$.group]; return { 'tree' : tree, 'child': tree[tree.length-1], 'append' : tree.slice(0,-1).join('/'), 'name' : tree.join('/'), encoded_root_vo : encodeURI($.root_vo)}} f()"
		  }
		},
		{
			"name" : "pyrest",
			"taskReferenceName" : "authorize",
			"type" : "SIMPLE",
			"inputParameters" : {
				"url" : "{{ keycloak }}/master/protocol/openid-connect/token",
				"method" : "POST",
				"headers" : {
					"Accept" : "application/json"
				},
				"body" : {
					"client_id" : "orchestrator", 
					"client_secret" : "{{ keycloak_auth_master }}",
					"grant_type" : "client_credentials"
				}
			}
		},
		{
			"name" : "check_is_gateway",
			"taskReferenceName" : "check_is_gateway",
			"type" : "SWITCH",
			"evaluatorType" : "javascript",
			"inputParameters" :{
				"group" : "${workflow.input.group}"
			},
			"expression": "$.group.toLowerCase().endsWith('gateway') ? 'gateway' : ''",
			"decisionCases" : {
				"gateway" : [
					{
					  "name" : "pyrest",
						"taskReferenceName" : "create_gateway_group",
						"type" : "SIMPLE",
						"inputParameters" : {
							"url" : "${init.input.keycloak_admin}/groups",
							"body" : { 
								"name" : "${init.output.result.child}"
							},
							"method" : "POST",
							"headers" : {
								"Authorization" : "Bearer ${authorize.output.body.access_token}",
								"Content-Type" : "application/json"
							}
						}
					},
					{
						"name" : "terminate",
						"taskReferenceName" : "terminate_when_gateway",
						"type" : "TERMINATE",
						"inputParameters" : {
							"terminationStatus" : "COMPLETED"
						}
					}
				]
			}
		},
		{
        "name" : "fork_join",
        "taskReferenceName" : "preliminary_fork",
        "type" : "FORK_JOIN",
        "forkTasks" : [
          [
		        {
			        "name" : "pyrest",
			        "taskReferenceName" : "create_client",
			        "type" : "SIMPLE",
			        "inputParameters" : {
				        "url" : "${init.input.keycloak_admin}/clients",
				        "body" : { 
					        "clientId": "${init.input.group}",
					        "name": "${init.output.result.name}",
					        "description": "Client representation for ${init.output.result.name} context",
					        "rootUrl": "http://localhost${init.output.result.name}",
					        "enabled": true,
					        "serviceAccountsEnabled": true,
					        "standardFlowEnabled": true,
					        "authorizationServicesEnabled": true,
					        "publicClient": false,
					        "fullScopeAllowed" : false,
					        "protocol": "openid-connect"
				        },
				        "method" : "POST",
				        "headers" : {
					        "Authorization" : "Bearer ${authorize.output.body.access_token}",
					        "Content-Type" : "application/json"
				        }
			        }
		        },
            {
                "name": "INLINE_TASK",
                "taskReferenceName": "extract_client_id",
                "type": "INLINE",
                "inputParameters": {
					"client_location" : "${create_client.output.headers.location}",
					"evaluatorType" : "javascript",
					"expression": "function f(){var client_id = $.client_location.split('/').pop(); return {'client_id' : client_id}} f()"
                }
            },
		    {
			  "name" : "pyrest",
				"taskReferenceName" : "list_kc_groups",
				"type" : "SIMPLE",
				"inputParameters" : {
					"url" : "${init.input.keycloak_admin}/groups",
					"method" : "GET",
					"headers" : {
						"Authorization" : "Bearer ${authorize.output.body.access_token}",
						"Accept" : "application/json"
					}
				}
			},
			{
				"name": "INLINE_TASK",
				"taskReferenceName": "prepare",
				"type": "INLINE",
				"inputParameters": {
					"evaluatorType" : "javascript",
					"append": "${init.output.result.append}",
		  			"groups": "${list_kc_groups.output.body}",
		  			"expression": "function recurse(inp){for(var i=0;i<inp.length;i++){if(inp[i]['path'] === $.append) return inp[i]; else{var subr = recurse(inp[i].subGroups); if(subr != null) return subr;}} return null}; function f(){return {'group' : $.append == '' ? '' : recurse($.groups)}} f()"
				}
			},
			{
				"name": "decide_task",
				"taskReferenceName": "decide1",
				"inputParameters": {
					"groupid": "${prepare.output.result.group}"
				},
				"type": "SWITCH",
				"evaluatorType" : "value-param",
				"expression": "groupid",
				"decisionCases": {
					"": [
						{
							"name": "INLINE_TASK",
							"taskReferenceName": "dummy",
							"type": "INLINE",
							"inputParameters": {
								"evaluatorType" :"javascript",
								"expression": "1"
							}
						}
					]
				},
				"defaultCase": [
					{
						"name": "pyrest",
						"taskReferenceName": "create_kc_group",
						"inputParameters": {
						  "url": "${init.input.keycloak_admin}/groups/${prepare.output.result.group.id}/children",
						  "body": {
							"name": "${init.output.result.child}"
						  },
						  "method": "POST",
						  "headers": {
							"Authorization": "Bearer ${authorize.output.body.access_token}",
							"Content-Type": "application/json"
						  }
						},
						"type": "SIMPLE"
					},
					{
						"name": "INLINE_TASK",
						"taskReferenceName": "prepare2",
						"inputParameters": {
						  "evaluatorType" : "javascript",
						  "location": "${create_kc_group.output.headers.location}",
						  "client_location": "${create_client.output.headers.location}",

						  "expression": "function f(){var newid=$.location.split('/').pop(); var client_id = $.client_location.split('/').pop(); return {'newid' : newid, 'client_id' : client_id}} f()"
						},
						"type": "INLINE"
					}
				]
			},
		    {
                "name" : "pyrest",
                "taskReferenceName" : "get_default_policies",
                "type" : "SIMPLE",
                "inputParameters" : {
                        "url" : "${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/policy",
                        "method" : "GET",
                        "headers" : {
                                "Authorization" : "Bearer ${authorize.output.body.access_token}",
                                "Accept" : "application/json"
                        }
                }
            },
            {
                "name" : "pyrest",
                "taskReferenceName" : "get_default_resource",
                "type" : "SIMPLE",
                "inputParameters" : {
                        "url" : "${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/resource",
                        "method" : "GET",
                        "headers" : {
                                "Authorization" : "Bearer ${authorize.output.body.access_token}",
                                "Accept" : "application/json"
                        }
                }
            },
		        {
                "name" : "pyrest",
                "taskReferenceName" : "delete_default_policy1",
                "type" : "SIMPLE",
                "inputParameters" : {
                        "url" : "${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/policy/${get_default_policies.output.body[0].id}",
                        "method" : "DELETE",
                        "headers" : {
                                "Authorization" : "Bearer ${authorize.output.body.access_token}",
                                "Accept" : "application/json"
                        }
                }
            },
		        {
                "name" : "pyrest",
                "taskReferenceName" : "delete_default_policy2",
                "type" : "SIMPLE",
                "inputParameters" : {
                        "url" : "${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/policy/${get_default_policies.output.body[1].id}",
                        "method" : "DELETE",
                        "headers" : {
                                "Authorization" : "Bearer ${authorize.output.body.access_token}",
                                "Accept" : "application/json"
                        }
                }
            },
            {
		          "name" : "pyrest",
		          "taskReferenceName" : "create_permission",
		          "type" : "SIMPLE",
		          "inputParameters" : {
			          "url" : "${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/permission/resource",
			          "body" : {
                   "name": "Default Permission",
                   "description": "",
                   "type" : "resource",
                   "logic": "POSITIVE",
                   "decisionStrategy": "AFFIRMATIVE",
                   "resources" : ["${get_default_resource.output.body[0]._id}"]
                },
			          "method" : "POST",
			          "headers" : {
				          "Authorization" : "Bearer ${authorize.output.body.access_token}",
				          "Content-Type" : "application/json",
					        "Accept" : "application/json"
			          }
		          }
	          }
        ],
        [
          {
              "name" : "pyrest",
              "taskReferenceName" : "get_rootvo",
              "type" : "SIMPLE",
              "inputParameters" : {
                  "url" : "${init.input.keycloak_admin}/clients?clientId=${init.output.result.encoded_root_vo}",
                  "method" : "GET",
                  "headers" : {
                      "Authorization" : "Bearer ${authorize.output.body.access_token}",
                      "Accept" : "application/json"
                  }
              }
          },
          {
              "name" : "pyrest",
              "taskReferenceName" : "get_rootvo_roles",
              "type" : "SIMPLE",
              "inputParameters" : {
                  "url" : "${init.input.keycloak_admin}/clients/${get_rootvo.output.body[0].id}/roles",
                  "method" : "GET",
                  "headers" : {
                      "Authorization" : "Bearer ${authorize.output.body.access_token}",
                      "Accept" : "application/json"
                  }
              }
          }
        ]
      ]
    },
    {
      "name" : "join",
      "type" : "JOIN",
      "taskReferenceName" : "preliminary_fork_join",
      "joinOn": [ "create_permission", "get_rootvo_roles"]
    },
	{
		"name" : "pyrest",
		"taskReferenceName" : "authorize1",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "{{ keycloak }}/master/protocol/openid-connect/token",
			"method" : "POST",
			"headers" : {
				"Accept" : "application/json"
			},
			"body" : {
				"client_id" : "orchestrator", 
				"client_secret" : "{{ keycloak_auth_master }}",
				"grant_type" : "client_credentials"
			}
		}
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "create_role_member",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "${create_client.output.headers.location}/roles",
			"body" : { 
				"clientRole" : true, "name" : "Member", "description" : "Simple membership for ${init.output.result.name}"
			},
			"method" : "POST",
			"headers" : {
				"Authorization" : "Bearer ${authorize1.output.body.access_token}",
				"Content-Type" : "application/json"
			}
		}
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "get_back_role_member",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "${create_role_member.output.headers.location}",
			"method" : "GET",
			"headers" : {
				"Authorization" : "Bearer ${authorize1.output.body.access_token}",
				"Accept" : "application/json"
			}
		}
	},
	{
		"name": "jq_1",
		"taskReferenceName": "to_array",
		"type": "JSON_JQ_TRANSFORM",
		"inputParameters": {
			"role": "${get_back_role_member.output.body}",
	        "queryExpression" : ".role"
	    }
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "add_role_member_as_component_of_infrastructure_member",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "${init.input.keycloak_admin}/roles/Infrastructure-Member/composites",
			"method" : "POST",
			"headers" : {
				"Authorization" : "Bearer ${authorize1.output.body.access_token}",
				"Content-Type" : "application/json"
			},
			"body" : "${to_array.output.resultList}"
		}
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "create_role_policy_member",
		"type" : "SIMPLE",
		"inputParameters" : {
	  		"url" : "${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/policy/role",
		  	"body" : {
	 			"name": "Member_policy",
			 	"description": "",
			 	"type" : "role",
			 	"logic": "POSITIVE",
			 	"decisionStrategy": "UNANIMOUS",
				 "roles" : [
					{
					  "id" : "${get_back_role_member.output.body.id}",
					  "required" : true
					}
				 ]
		  	},
		  	"method" : "POST",
		  	"headers" : {
			  "Authorization" : "Bearer ${authorize1.output.body.access_token}",
			  "Content-Type" : "application/json",
			  "Accept" : "application/json"
		  	}
		}
	},
	{
		"name": "decide_task",
		"taskReferenceName": "decide2",
		"inputParameters": {
			"groupid": "${prepare.output.result.group}"
		},
		"type": "SWITCH",
		"evaluatorType" : "value-param",
		"expression": "groupid",
		"decisionCases": {
			"": [
				{
					"name": "INLINE_TASK",
					"taskReferenceName": "dummy2",
					"type": "INLINE",
					"inputParameters": {
						"evaluatorType" : "javascript",
						"expression": "1"
					}
				}
			]
		},
		"defaultCase": [
			{
			  "name" : "pyrest",
				"taskReferenceName" : "assign_client_member_role_to_kc_group",
				"type" : "SIMPLE",
				"inputParameters" : {
					"url" : "${init.input.keycloak_admin}/groups/${prepare2.output.result.newid}/role-mappings/clients/${prepare2.output.result.client_id}",
					"method" : "POST",
					"body" : ["${get_back_role_member.output.body}"],
					"headers" : {
						"Authorization" : "Bearer ${authorize1.output.body.access_token}",
						"Accept" : "application/json",
						"Content-Type" : "application/json"
					}
				}
			}
		]
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "authorize2",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "{{ keycloak }}/master/protocol/openid-connect/token",
			"method" : "POST",
			"headers" : {
				"Accept" : "application/json"
			},
			"body" : {
				"client_id" : "orchestrator", 
				"client_secret" : "{{ keycloak_auth_master }}",
				"grant_type" : "client_credentials"
			}
		}
	},
	{
		"name": "INLINE_TASK",
		"taskReferenceName": "build_add_role_tasks",
		"type": "INLINE",
		"inputParameters": {
		  "evaluatorType" : "javascript",
		  "roles" : "${get_rootvo_roles.output.body}",
		  "expression": "inputs={},tasks=[];function add(r, k){ if(r.name != 'uma_protection' && r.name != 'Member'){ tasks.push({name:'pyrest',type:'SIMPLE',taskReferenceName:'create_'+k}); inputs['create_'+k]={url:'${create_client.output.headers.location}/roles',body:{clientRole:true,name:r.name,description:r.description},method:'POST',headers:{Authorization:'Bearer ${authorize2.output.body.access_token}','Content-Type':'application/json'}}}};for(var i=0;i<$.roles.length;i++)r=$.roles[i],k='add-'+r.name, add(r, k); function f(){return {tasks:Java.to(tasks,'java.util.Map[]'),inputs:inputs};} f()"
		}
	},
	{
		"name" : "fork_dynamic",
		"type" : "FORK_JOIN_DYNAMIC",
		"taskReferenceName" : "parallel_add_role",
		"inputParameters" : {
			"tasks" : "${build_add_role_tasks.output.result.tasks}",
			"inputs" : "${build_add_role_tasks.output.result.inputs}"
		},
		"dynamicForkTasksParam": "tasks",
		"dynamicForkTasksInputParamName": "inputs"
	},
	{
	  "name" : "join",
	  "type" : "JOIN",
	  "taskReferenceName" : "join_parallel_role_addition"
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "authorize3",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "{{ keycloak }}/master/protocol/openid-connect/token",
			"method" : "POST",
			"headers" : {
				"Accept" : "application/json"
			},
			"body" : {
				"client_id" : "orchestrator", 
				"client_secret" : "{{ keycloak_auth_master }}",
				"grant_type" : "client_credentials"
			}
		}
	},
	{
		"name": "INLINE_TASK",
		"taskReferenceName": "build_get_back_role_tasks",
		"type": "INLINE",
		"inputParameters": {
		  "evaluatorType" : "javascript",
		  "roleurls" : "${join_parallel_role_addition.output[*]..location}",
		  "expression": "inputs={},tasks=[];function f(){for(var i=0;i<$.roleurls.length;i++)u=$.roleurls[i],k='add-'+i,tasks.push({name:'pyrest',type:'SIMPLE',taskReferenceName:'get_back_'+k}),inputs['get_back_'+k]={url:u,method:'GET',headers:{Authorization:'Bearer ${authorize3.output.body.access_token}',Accept:'application/json'}};return {tasks:Java.to(tasks,'java.util.Map[]'),inputs:inputs};} f()"
		}
	},
	{
		"name" : "fork_dynamic",
		"type" : "FORK_JOIN_DYNAMIC",
		"taskReferenceName" : "parallel_get_back_role",
		"inputParameters" : {
			"tasks" : "${build_get_back_role_tasks.output.result.tasks}",
			"inputs" : "${build_get_back_role_tasks.output.result.inputs}"
		},
		"dynamicForkTasksParam": "tasks",
		"dynamicForkTasksInputParamName": "inputs"
	},
	{
	  "name" : "join",
	  "type" : "JOIN",
	  "taskReferenceName" : "join_parallel_getting_back"
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "authorize4",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "{{ keycloak }}/master/protocol/openid-connect/token",
			"method" : "POST",
			"headers" : {
				"Accept" : "application/json"
			},
			"body" : {
				"client_id" : "orchestrator", 
				"client_secret" : "{{ keycloak_auth_master }}",
				"grant_type" : "client_credentials"
			}
		}
	},
	{
		"name": "INLINE_TASK",
		"taskReferenceName": "build_add_policy_tasks",
		"type": "INLINE",
		"inputParameters": {
		  "evaluatorType" : "javascript",
		  "roles" : "${join_parallel_getting_back.output[*].body}",
		  "expression": "inputs={},tasks=[];function f(){for(var i=0;i<$.roles.length;i++)r=$.roles[i],k='add-'+r.name,tasks.push({name:'pyrest',type:'SIMPLE',taskReferenceName:'create_role_policy_'+k}),inputs['create_role_policy_'+k]={url:'${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/policy/role',body:{name:r.name+'_policy',description:'',type:'role',logic:'POSITIVE',decisionStrategy:'UNANIMOUS',roles:Java.to([{id:r.id,required:true}], 'java.util.Map[]')},method:'POST',headers:{Authorization:'Bearer ${authorize4.output.body.access_token}', Accept: 'application/json', 'Content-Type':'application/json'}};return {tasks:Java.to(tasks,'java.util.Map[]'),inputs:inputs};} f()"
		}
	},
	{
		"name" : "fork_dynamic",
		"type" : "FORK_JOIN_DYNAMIC",
		"taskReferenceName" : "parallel_add_policy_role",
		"inputParameters" : {
			"tasks" : "${build_add_policy_tasks.output.result.tasks}",
			"inputs" : "${build_add_policy_tasks.output.result.inputs}"
		},
		"dynamicForkTasksParam": "tasks",
		"dynamicForkTasksInputParamName": "inputs"
	},
	{
	  "name" : "join",
	  "type" : "JOIN",
	  "taskReferenceName" : "join_parallel_policy_addition"
	},
	{
		"name": "INLINE_TASK",
	  	"taskReferenceName": "policy_list",
		"type": "INLINE",
 		"inputParameters": {
			"evaluatorType" : "javascript",
			"memberpolicy" : "${create_role_policy_member.output.body.id}",
			"otherpolicies" : "${join_parallel_policy_addition.output[*].body.id}",
			"expression": "function f(){return Java.to(Java.from($.otherpolicies).concat($.memberpolicy), 'java.lang.String[]')} f()"
		  }
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "authorize5",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "{{ keycloak }}/master/protocol/openid-connect/token",
			"method" : "POST",
			"headers" : {
				"Accept" : "application/json"
			},
			"body" : {
				"client_id" : "orchestrator", 
				"client_secret" : "{{ keycloak_auth_master }}",
				"grant_type" : "client_credentials"
			}
		}
	},
	{
		"name" : "pyrest",
		"taskReferenceName" : "finalize_permission",
		"type" : "SIMPLE",
		"inputParameters" : {
			"url" : "${init.input.keycloak_admin}/clients/${extract_client_id.output.result.client_id}/authz/resource-server/permission/resource/${create_permission.output.body.id}",
			"body" : {
				"name": "Default Permission",
				"description": "",
				"type" : "resource",
				"logic": "POSITIVE",
				"decisionStrategy": "AFFIRMATIVE",
				"policies" : "${policy_list.output.result}"
			},
	  		"method" : "PUT",
			"headers" : {
			  "Authorization" : "Bearer ${authorize5.output.body.access_token}",
			  "Content-Type" : "application/json"
			}
  		}
	},
	{
        "name" : "fork_subworkflows",
        "type" : "FORK_JOIN",
        "taskReferenceName" : "parallel_call_subworkflows",
        "forkTasks" : [
        	[
    			{
				  "name": "sub_workflow_task",
				  "taskReferenceName": "call_enable_workspace_clients_for_context",
				  "subWorkflowParam": {
					"name": "enable_workspace_clients_for_context"
				  },
				  "inputParameters": {
		  			"context" : "${workflow.input.group}"
				  },
				  "type": "SUB_WORKFLOW"
			   }
        	],
        	[
				{
				  "name": "sub_workflow_task",
				  "taskReferenceName": "call_jupyterhub_add_serveroptions_to_context",
				  "subWorkflowParam": {
					"name": "jupyterhub_add_serveroptions_to_context"
				  },
				  "inputParameters": {
		  			"context" : "${workflow.input.group}"
				  },
				  "type": "SUB_WORKFLOW"
			   }        		
        	]
        ]
	},
	{
    	  "name" : "join",
          "type" : "JOIN",
          "taskReferenceName" : "join_parallel_call_subworkflows",
		  "joinOn" :[
		  	"call_enable_workspace_clients_for_context",
		  	"call_jupyterhub_add_serveroptions_to_context"
		  ] 
	}
	]
}